CVE-2026-30495
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Optoma CinemaX P2是Optoma公司的一款超短焦4K激光家用投影仪。 Optoma CinemaX P2存在安全漏洞，该漏洞源于在TCP端口5555上暴露Android调试桥且无需身份验证，同时禁用RSA密钥验证且存在无需身份验证即可授予root权限的su二进制文件，可能导致同一网络上的攻击者通过ADB连接设备、获取shell并提升至root权限，从而完全控制设备，提取存储的WiFi凭据、安装持久性恶意软件并访问所有设备数据。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-30495
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP port 5555 over the network without requiring authentication. The device is configured with ro.adb.secure=0, which disables RSA key verification. Additionally, a functional su binary exists at /system/xbin/su that grants root privileges without authentication. An attacker on the same network can connect to the device via ADB, obtain a shell, and escalate to root privileges, gaining complete control of the device. This allows extraction of stored WiFi credentials, installation of persistent malware, and access to all device data.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Optoma CinemaX P2 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Optoma CinemaX P2是Optoma公司的一款超短焦4K激光家用投影仪。 Optoma CinemaX P2存在安全漏洞，该漏洞源于在TCP端口5555上暴露Android调试桥且无需身份验证，同时禁用RSA密钥验证且存在无需身份验证即可授予root权限的su二进制文件，可能导致同一网络上的攻击者通过ADB连接设备、获取shell并提升至root权限，从而完全控制设备，提取存储的WiFi凭据、安装持久性恶意软件并访问所有设备数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-30495
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-30495
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-30495 (1)
Same Patch Batch · n/a · 2026-05-07 · 14 CVEs total
| CVE-2026-8114 | 6.3 MEDIUM | JeecgBoot JSON Object loadTreeData sql injection |
| CVE-2026-36458 | ChestnutCMS 安全漏洞 | |
| CVE-2026-30496 | Optoma CinemaX P2 安全漏洞 | |
| CVE-2025-67202 | sidekiq-cron 安全漏洞 | |
| CVE-2025-63706 | next-npm-version 1.0.1 安全漏洞 | |
| CVE-2025-63705 | Node Typescript OCR 安全漏洞 | |
| CVE-2026-36387 | CodeAstro Membership Management System 代码问题漏洞 | |
| CVE-2026-36388 | PHPGurukul Hospital Management System 跨站脚本漏洞 | |
| CVE-2025-65122 | youtube-regex 资源管理错误漏洞 | |
| CVE-2026-36341 | Webkul Krayin CRM 跨站脚本漏洞 | |
| CVE-2025-63704 | Query String Parser 安全漏洞 | |
| CVE-2025-63703 | parse-ini 安全漏洞 | |
| CVE-2026-37709 | Snipe-IT 访问控制错误漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-30495
No comments yet